Actually the problem is that they are too widespread. if something happened, and they started creating fake certificates, for outside force or otherwise, they can’t just be blocked because literally half of the internet or more breaks. what’s worse, if browser vendors trued that, people would be downgrading their browser to the last version accepting it, and become exposed to publicly revealed security vulnerabilities. not all because its a bit complicated, but enough would do to have it cause an even greater problem.
Comment on Letsencrypt is under US jurisdiction. Is there a free-er alternative?
pdl@social.tchncs.de 8 hours ago
@Sibbo I do not see any problem with Letsencrypt. Any CA which is widely trusted has to follow the same rules. This rules are set up by the CA Browser Forum. Which metadata does LE collect? My server's IP address, domain and subdomain, mail address. These are logged in the CT logs. Every CA has to log all certificates in a public CT log. Regardless which CA I choose, these data are public. There are not any critical data or metadata that LE can collect.
WhyJiffie@sh.itjust.works 2 hours ago
possiblylinux127@lemmy.zip 1 hour ago
You do make a good point. However, Let’s encrypt is run by the IRSG which is a non profit focused on improving internet security. They are the ones who are pushing for shorter certificate lifetimes among other things.
Sibbo@sopuli.xyz 7 hours ago
Letsencrypt can be directly forced to revoke certificates by the US. Organisations outside of the US are less vulnerable against that.
slazer2au@lemmy.world 6 hours ago
And ICAAN can hand your domain over to US law enforcement regardless of the TLD and your register.
Is that also part of your decision tree?
Pika@sh.itjust.works 4 hours ago
Is this accurate? Like, I know what you’re meaning, but I’m pretty sure it’s not ICANN doing it, and more so your domain registrar handing it over to the US government.
I think the most control that ICANN has over it is they could theoretically, if they wanted to, delete an entire top level domain. Since they do control the DNS root, but that is the most that they control from what I understand.
I don’t know if they have the ability to delete or transfer control over an individual domain on legal request. I think that’s outside of what their actual system allows for.
libewa@feddit.org 6 hours ago
ICANN can (theoretically) not force anyone to deregister your domain. If your stack is all outside the US, and everyone collectively decided to disobey the US, the Internet’s decentralization would be true.
For the Internet, the centralization is hidden in the IP block and DNS Zone delegation. After this is done, that region is decentralized. A/I’s problem was that the registry for .org is a subsidiary of IANA. With EU servers, EU DNS and a EU domain, EU clients cannot be prevented from connecting solely from the outside. The US would need a collaborator.
slazer2au@lemmy.world 6 hours ago
That is all well and good, but we have many instances of domains being pulled from people because of court ruling and your register is not going to defy a court ruling for your €17/year domain.
Auli@lemmy.ca 5 hours ago
Aren’t the .country domains managed by the countries?
slazer2au@lemmy.world 15 minutes ago
Who all get that authority from ICAAN
veniasilente@lemmy.dbzer0.com 5 hours ago
Maybe it should be! We need non-fascis-adjacent DNS roots.
frongt@lemmy.zip 3 hours ago
opennic.org
eleitl@lemmy.zip 4 hours ago
There are authorityless blockchain-backed name registration services. In general, it is important whether you can localize a resource. If you can easily find it, it doesn’t have to human-readable.
IpsumLauren@lemmy.world 2 hours ago
That would be just a nuisance until a new certificate is generated with another vendor (possibly not for free, but cheap enough).
pdl@social.tchncs.de 6 hours ago
@Sibbo Of course. Actually, there are 200 million active certificates issued by Letsencrypt. Revoking them, 200 million websites would be down. 200 million websites all over the world, including US. I don't think this is a realistic scenario.
If you are worried about that, you should avoid any software developed in US. You should avoid any software which itself or its sources are hosted in US. Mastodon is available on Github, this is Microsoft. US authorities may force Github to shutdown or infiltrate the hosted sources with spyware.